fixes from AI review:

linuxkm/lkcapi_aes_glue.c and linuxkm/lkcapi_sha_glue.c: add CMAC and SHA-3 to algs warned for incompatibility with kernels <5.6;

linuxkm/lkcapi_aes_glue.c, wolfcrypt/src/aes.c, wolfcrypt/src/memory.c, and wolfssl/wolfcrypt/memory.h: fix WC_DEBUG_CIPHER_LIFECYCLE in kernel mode (km_AesGet() and km_AesCmacMaterialize()), add WARN_UNUSED_RESULT to wc_debug_CipherLifecycle*(), and fix an unchecked wc_debug_CipherLifecycleFree() in wc_AesFree();

linuxkm/lkcapi_aes_glue.c: fix unsafe wc_CmacFree() call in km_AesCmacSetKey();

linuxkm/lkcapi_sha_glue.c: in km_hmac_export(), avoid unlocked access to snapshot->desc_id (possible UAF under extreme pressure).

Author: douzzer

linuxkm/lkcapi_aes_glue.c

@@ -271,6 +271,10 @@
     #undef LINUXKM_LKCAPI_REGISTER_AESCMAC
 #endif
 
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 6, 0)) && defined(LINUXKM_LKCAPI_REGISTER_AESCMAC)
+    #error LINUXKM_LKCAPI_REGISTER for AES-CMAC is supported only on Linux kernel versions >= 5.6.0.
+#endif
+
 #ifdef LINUXKM_LKCAPI_REGISTER_AESCMAC
     #include <wolfssl/wolfcrypt/cmac.h>
 #endif
@@ -513,6 +517,16 @@ static int km_AesGet(struct km_AesCtx *ctx, int decrypt_p, int copy_p, Aes **aes
         XMEMCPY(aes_copy, ret, sizeof(Aes));
 #if defined(WOLFSSL_AESGCM_STREAM) && defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_AESNI)
         aes_copy->streamData = NULL;
+#endif
+#ifdef WC_DEBUG_CIPHER_LIFECYCLE
+        {
+            int ret2 = wc_debug_CipherLifecycleInit(&aes_copy->CipherLifecycleTag, NULL);
+            if (ret2 != 0) {
+                ForceZero(aes_copy, sizeof *aes_copy);
+                free(aes_copy);
+                return -ENOMEM;
+            }
+        }
 #endif
         *aes = aes_copy;
     }
@@ -5017,6 +5031,9 @@ static int linuxkm_test_aesecb(void) {
  * configurations: wc_AesFree()'s only mainstream XFREE() target is the
  * GCM-streaming streamData buffer, which the CMAC path never allocates.
  * _CRYPTO_CB per-instance contexts would break that invariant.
+ *
+ * The tracking allocation when WC_DEBUG_CIPHER_LIFECYCLE is accommodated
+ * explicitly in km_AesCmacMaterialize().
  */
 #if defined(WOLF_CRYPTO_CB) && defined(WOLF_CRYPTO_CB_FREE)
     #error LINUXKM_LKCAPI_REGISTER_AESCMAC is incompatible with WOLF_CRYPTO_CB_FREE.
@@ -5111,14 +5128,16 @@ static int km_AesCmacSetKey(struct crypto_shash *tfm, const u8 *key,
         /* wc_InitCmac() zeroizes the Cmac before use, but doesn't release the
          * embedded Aes on post-wc_AesInit() failures.
          */
+        if (ret != WC_NO_ERR_TRACE(BAD_FUNC_ARG)) {
 #ifdef WC_LINUXKM_CMAC_HAVE_CMACFREE
-        (void)wc_CmacFree(new_pristine);
+            (void)wc_CmacFree(new_pristine);
 #else
-        /* no wc_CmacFree() in the boundary -- a failed-init Cmac holds no
-         * allocations in pre-v6 FIPS configurations, so zeroization suffices.
-         */
-        ForceZero(new_pristine, sizeof(*new_pristine));
+            /* no wc_CmacFree() in the boundary -- a failed-init Cmac holds no
+             * allocations in pre-v6 FIPS configurations, so zeroization suffices.
+             */
+            ForceZero(new_pristine, sizeof(*new_pristine));
 #endif
+        }
         free(new_pristine);
         /* fail closed on rekey failure -- the kernel re-flags NEED_KEY, and a
          * stale pristine would misattribute subsequent traffic to the old
@@ -5166,6 +5185,16 @@ static int km_AesCmacMaterialize(struct crypto_shash *tfm,
         return -ENOMEM;
 
     XMEMCPY(cmac, t_ctx->pristine, sizeof(*cmac));
+#ifdef WC_DEBUG_CIPHER_LIFECYCLE
+    {
+        int ret = wc_debug_CipherLifecycleInit(&cmac->aes.CipherLifecycleTag, NULL);
+        if (ret != 0) {
+            ForceZero(cmac, sizeof *cmac);
+            free(cmac);
+            return -ENOMEM;
+        }
+    }
+#endif
 
     XMEMCPY(cmac->digest, st->digest, WC_AES_BLOCK_SIZE);
     XMEMCPY(cmac->buffer, st->buffer, WC_AES_BLOCK_SIZE);

linuxkm/lkcapi_sha_glue.c

@@ -407,7 +407,11 @@
 #endif
 
 #if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 6, 0)) &&  \
-    (defined(LINUXKM_LKCAPI_REGISTER_SHA1_HMAC) ||     \
+    (defined(LINUXKM_LKCAPI_REGISTER_SHA3_224)      || \
+     defined(LINUXKM_LKCAPI_REGISTER_SHA3_256)      || \
+     defined(LINUXKM_LKCAPI_REGISTER_SHA3_384)      || \
+     defined(LINUXKM_LKCAPI_REGISTER_SHA3_512)      || \
+     defined(LINUXKM_LKCAPI_REGISTER_SHA1_HMAC)     || \
      defined(LINUXKM_LKCAPI_REGISTER_SHA2_224_HMAC) || \
      defined(LINUXKM_LKCAPI_REGISTER_SHA2_256_HMAC) || \
      defined(LINUXKM_LKCAPI_REGISTER_SHA2_384_HMAC) || \
@@ -416,7 +420,7 @@
      defined(LINUXKM_LKCAPI_REGISTER_SHA3_256_HMAC) || \
      defined(LINUXKM_LKCAPI_REGISTER_SHA3_384_HMAC) || \
      defined(LINUXKM_LKCAPI_REGISTER_SHA3_512_HMAC))
-    #error LINUXKM_LKCAPI_REGISTER for HMACs is supported only on Linux kernel versions >= 5.6.0.
+    #error LINUXKM_LKCAPI_REGISTER for SHA-3 and HMACs is supported only on Linux kernel versions >= 5.6.0.
 #endif
 
 #ifdef HAVE_HASHDRBG
@@ -1588,6 +1592,7 @@ WC_MAYBE_UNUSED static int km_hmac_export(struct shash_desc *desc, void *out)
     struct km_sha_hmac_node *snapshot;
     struct km_sha_hmac_node *evicted = NULL;
     int ret;
+    typeof(snapshot->desc_id) snapshot_desc_id;
 
     if (s_ctx->node == NULL)
         return -EINVAL;
@@ -1624,7 +1629,7 @@ WC_MAYBE_UNUSED static int km_hmac_export(struct shash_desc *desc, void *out)
         list_del(&evicted->desc_ent);
         p_ctx->export_list_len--;
     }
-    snapshot->desc_id = p_ctx->cur_desc_id++;
+    snapshot_desc_id = snapshot->desc_id = p_ctx->cur_desc_id++;
     /* list_add() prepends, so the tail from list_last_entry() is the oldest. */
     list_add(&snapshot->desc_ent, &p_ctx->export_list);
     p_ctx->export_list_len++;
@@ -1645,7 +1650,7 @@ WC_MAYBE_UNUSED static int km_hmac_export(struct shash_desc *desc, void *out)
     XMEMSET(blob, 0, sizeof(*blob));
     blob->magic = WC_LINUXKM_HMAC_EXPORT_MAGIC;
     blob->tfm_cookie = p_ctx->tfm_cookie;
-    blob->desc_id = snapshot->desc_id;
+    blob->desc_id = snapshot_desc_id;
 
     return 0;
 }

wolfcrypt/src/aes.c

@@ -15550,7 +15550,11 @@ void wc_AesFree(Aes* aes)
 #endif /* WOLF_CRYPTO_CB && WOLF_CRYPTO_CB_FREE */
 
 #ifdef WC_DEBUG_CIPHER_LIFECYCLE
-    (void)wc_debug_CipherLifecycleFree(&aes->CipherLifecycleTag, aes->heap, 1);
+    {
+        int ret = wc_debug_CipherLifecycleFree(&aes->CipherLifecycleTag, aes->heap, 1);
+        if (ret != 0)
+            WOLFSSL_DEBUG_PRINTF("ERROR: wc_AesFree(): wc_debug_CipherLifecycleFree() returned %d.\n", ret);
+    }
 #endif
 
 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_AES)

wolfcrypt/src/memory.c

@@ -1735,8 +1735,12 @@ WOLFSSL_LOCAL int wc_debug_CipherLifecycleCheck(
     ret = 0;
 
 out:
+#ifdef WOLFSSL_KERNEL_MODE
+    (void)abort_p;
+#else
     if ((ret < 0) && abort_p)
         abort();
+#endif
 
     return ret;
 }

wolfssl/wolfcrypt/memory.h

@@ -340,12 +340,17 @@ WOLFSSL_API int wc_ConstantCompare(const byte* a, const byte* b, int length);
 #endif
 
 #ifdef WC_DEBUG_CIPHER_LIFECYCLE
-WOLFSSL_LOCAL int wc_debug_CipherLifecycleInit(void **CipherLifecycleTag,
-                                               void *heap);
-WOLFSSL_LOCAL int wc_debug_CipherLifecycleCheck(void *CipherLifecycleTag,
-                                                int abort_p);
-WOLFSSL_LOCAL int wc_debug_CipherLifecycleFree(void **CipherLifecycleTag,
-                                               void *heap, int abort_p);
+#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)
+    #define WC_DEBUG_CIPHERLIFECYCLE_WUR WARN_UNUSED_RESULT
+#else
+    #define WC_DEBUG_CIPHERLIFECYCLE_WUR
+#endif
+WOLFSSL_LOCAL WC_DEBUG_CIPHERLIFECYCLE_WUR int wc_debug_CipherLifecycleInit
+                                       (void **CipherLifecycleTag, void *heap);
+WOLFSSL_LOCAL WC_DEBUG_CIPHERLIFECYCLE_WUR int wc_debug_CipherLifecycleCheck
+                                       (void *CipherLifecycleTag, int abort_p);
+WOLFSSL_LOCAL WC_DEBUG_CIPHERLIFECYCLE_WUR int wc_debug_CipherLifecycleFree
+                          (void **CipherLifecycleTag, void *heap, int abort_p);
 #else
 #define wc_debug_CipherLifecycleInit(CipherLifecycleTag, heap) \
         ((void)(CipherLifecycleTag), (void)(heap), 0)